Cyber resilience: NISM and IFSCA launch certifications for GIFT IFSC
The National Institute of Securities Markets (NISM) has launched two certification courses on Cyber Security and Cyber Resilience in the GIFT IFSC, aimed at strengthening capability across the International Financial Services Centre ecosystem. NISM Director Sashi Krishnan and IFSCA Chairperson K. Rajaraman launched the courses — NISM-IFSCA-02A (Basic) and NISM-IFSCA-02B (Advanced) — with IFSCA Executive Director Praveen Trivedi present.
The Basic course targets IFSCA officers and employees of regulated entities (REs), along with individuals outside REs who want a grounding in the subject. It covers the evolving threat landscape, governance and risk management, security architecture, asset and access management, third-party risk, application and data security, vulnerability management, cyber hygiene, and incident response and recovery. It also introduces emerging challenges, including AI and quantum computing.
The Advanced course targets key function holders — CISOs, Principal Officers, Designated Officers and Compliance Officers of REs. It builds on existing knowledge, focusing on governance and risk management, cyber incident preparedness and resilience, applying security principles across domains, and interpreting the regulatory requirements that apply to entities in the GIFT IFSC. The two courses differ in depth, but both are built on the same idea: that cyber resilience is a discipline the sector has to share, not a specialty held by a few.
The examinations are specific. The Basic exam has 50 one-mark questions in 60 minutes, a 50% pass mark and no negative marking; it costs ₹1,180 including taxes and the certificate is valid for two years, with the course open from 18 November 2026. The Advanced exam has 80 multiple-choice questions and three case-based questions in two hours, a 60% pass mark and 25% negative marking; it costs ₹2,950 including taxes and the certificate is valid for three years, from 30 December 2026. Candidates get a free workbook, and register through the NISM certification portal.
The regime behind it
The certifications did not appear in isolation. NISM developed them under a memorandum of understanding with IFSCA, aligned to the regulator’s Training and Awareness Guidelines. Those guidelines are part of a wider move. For years, financial-sector cyber regulation in India was a matter of periodic audits; IFSCA’s approach has shifted toward continuous obligations, with named accountability and explicit reporting timelines.
The certifications extend that logic to people: if an entity must have a CISO accountable for cyber resilience, then the CISO, and the officers around them, need a common baseline of knowledge. The Basic course sets that baseline; the Advanced course deepens it for the function holders who carry the responsibility. The training layer also gives IFSCA a way to raise the floor across a heterogeneous ecosystem, where entities range from large exchanges to small fund managers and branches of foreign firms. A shared vocabulary for cyber resilience is easier to supervise than a patchwork of internal practices. They are the human-capital layer of a cyber regime that IFSCA has tightened steadily.
IFSCA issued principles-based cyber security and cyber resilience guidelines for all REs in March 2025, effective that April, with compliance proportional to an entity’s scale and systemic role. It amended them in March 2026. In April 2026, it issued far more prescriptive guidelines for Market Infrastructure Institutions — stock exchanges, clearing corporations, depositories and the bullion exchange — structured around seven functions: govern, identify, protect, detect, respond, recover and resilience.
MII Guidelines
Those MII guidelines require a board-approved policy, a CISO reporting directly to the MD or CEO, a round-the-clock cyber security operations centre, ISO 27001 certification within two years, annual cryptographic risk assessments, and roadmaps for post-quantum cryptography to guard against quantum threats. They also require incident notification to IFSCA and CERT-In within six hours. In 2026, IFSCA added an advisory on the heightened cyber risk from frontier AI models, telling REs to assume new critical vulnerabilities are exploitable within hours and to treat frontier-AI risk as a defined scenario.
Why now: the threat backdrop
The certifications land against a threat landscape that has moved quickly. The RBI’s Financial Stability Report found AI-enabled cyberattacks are the biggest near-term cyber risk for India’s financial system, with banks and NBFCs naming them their top concern and preparedness uneven across the sector. About 93% of surveyed institutions depend partially or substantially on external vendors for security functions — a supply-chain exposure the regulator has flagged as a systemic risk.
The threat shift is qualitative as well as quantitative. Traditional attacks looked like malware or a perimeter breach; the newer pattern manipulates trusted identities, applications and business processes, so that activity resembles a legitimate session or an authorised payment. Frontier AI models have compressed the time between a vulnerability’s disclosure and its exploitation, and the Digital Threat Report describes an attack in which AI handled most of the repetitive technical work while humans kept strategic control. That is why IFSCA’s advisory treats AI-driven attacks as a defined scenario, and why the NISM courses fold AI and quantum risk into the syllabus rather than leaving them to specialists.
The CERT-In, CSIRT-Fin and SISA Digital Threat Report 2025-26 found India’s BFSI sector faces cyberattacks at 1.6 times the global average, with reported incidents rising from 1.4 million in 2021 to 2.9 million in 2025 and a mean time to contain a breach of 263 days. It documented what it described as the first largely AI-orchestrated attack, and warned of a widening gap between compliance and real-world resilience. A BCG-DSCI report found 76% of CISOs rank AI-enabled attacks among their top priorities for 2026.
Certification versus resilience
That gap is where the certification question sits. IFSCA’s guidelines rest on the principle that cyber security is a foundational pillar of a credible financial centre. But the threat report’s central warning is that passing an audit does not prove a control works under attack — the compliance-versus-resilience gap. The gap is not hypothetical. Institutions can pass periodic assessments and still fail under adversarial pressure, because controls drift, scopes slip or frameworks lag behind how attackers operate. Continuous assurance — proving that a control keeps working while an attack is under way — is the response the threat report recommends, and it is a demanding standard. Cyber resilience, in that framing, is not a certificate on a wall but a property that has to hold in real time. NISM’s courses speak to the knowledge half of that problem; the operational half rests with the entities themselves.
A certification such as NISM’s can close part of that gap by raising the knowledge baseline of the people accountable for cyber risk: the CISOs, Principal Officers and Compliance Officers the Advanced course targets. It cannot close all of it. Knowing the regulatory requirements is not the same as meeting them, and training staff does not, by itself, harden a payment rail or a supply chain. The RBI has said financial resilience and technological resilience increasingly reinforce each other, and that AI can be both an instrument of attack and a tool of defence — a dual role that the NISM courses acknowledge by covering AI and quantum computing alongside governance and incident response. The point is sharpened by the RBI’s own framing: cyber resilience is now a board-level concern rather than a technical one.
What to watch
For REs, the question is whether the certification becomes an expectation for key function holders, and whether entities use it to build a skills pipeline or simply to tick a box. For IFSCA, the test is whether a training layer strengthens resilience in practice, or becomes another control that passes assessment without changing outcomes. Then, for the wider ecosystem, the course content is a signal: AI and post-quantum risk are now part of the baseline vocabulary for the people who run cyber security in India’s international financial centre. For candidates, the practical calculus is straightforward: the Basic course is cheap and broad, the Advanced course is aimed at people whose job titles already carry cyber accountability.
The bigger question is whether cyber resilience becomes a hiring and promotion criterion in the GIFT IFSC, or stays an optional credential. If REs start expecting it of key function holders, the courses will have done more than add a line to a résumé.
What the announcement does and doesn’t establish
It establishes two courses, their content, their exam structures, fees and validity, and their launch dates. It does not establish that the certification is mandatory. The release does not say so, and NISM’s own page labels its AML course as mandated by IFSCA while carrying no such label for these two; the stated basis is alignment with IFSCA’s Training and Awareness Guidelines, which is not a mandate. What it does establish is that cyber resilience is now something the regulator expects the sector to be able to talk about in a common language, from the boardroom to the operations centre. Nor does the release give enrolment targets, completion rates or any measure of whether the training improves resilience.
The honest summary is that NISM and IFSCA have added a training rung to a cyber regime that has grown more prescriptive and more urgent in a year. The courses are a real step in building capability, and the threat data explains why they matter. Whether they change how resilient GIFT IFSC’s entities actually are is a question only the next few years of incidents — and audits — will answer.